I downloaded some malicious file exactly 1 day before it happened on laptop that I use when traveling, so nothing important on it, at least I thought so, I missed that there was brave browser synced to my other devices and I haven't unsynced it (big mistake)
If you don't have Brave browser set to delete browsing history each time you close it down than they didn't need to hack anything.
Just opening browser and going through your history and bookmarked pages would be enough for them to access and change your account.
I would suggest stop using browser password managers and switch to something like KeePass, and switch from wind0ws to Linux OS.